Access control for object instances

US11870786B2 · kind B2 · utility

Assignee

• SAP SE · DE

Inventors

• Marco Koch · Hamburg, DE
• Stefan Boller · Heidelberg, DE
• Manfred Schmid · Neutraubling, DE

Key dates

• Filing date: Aug 15, 2022
• Grant date: Jan 9, 2024
• Expiry date: Sep 18, 2042

Classification

• Technology area (CPC H): Electricity
• CPC primary: H04L67/025
• WIPO field: Digital communication
• WIPO sector: Electrical engineering

Abstract

The present disclosure involves systems, software, and computer implemented methods for access control for object instances. A method includes receiving, at a cloud application, a user request associated with a user. The user request corresponds to an instance of a first application artifact type. Role assignments for the user are retrieved from a cloud platform and a determination is made that the role assignments grant permission to the first application artifact type to the user. A determination is made that a first instance-based access policy exists for the first application artifact type. A determination is made regarding whether the first instance-based access policy grants permission for the user to access the instance. The user request is serviced in response to determining that the first instance-based access policy grants permission for the user to access the instance. The use request is denied in response to determining that the first instance-based access policy does not grant permission for the user to access the instance.